Is CVE-2026-94453 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-94453 being exploited in the wild.

How severe is CVE-2026-94453?

High severity, with a CVSS score of 7.5, published 13 October 2026.

How is CVE-2026-94453 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-94453?

Check whether you run Libreswan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-94453: Libreswan pluto use-after-free in IKE over TCP

Q: Is there a fix for CVE-2026-94453?

Yes: fixed in Libreswan 5.3, 5.4. Until then: Disable IKE over TCP if not required by setting listen-tcp=no in the Libreswan configuration, or restrict network access to the pluto daemon from untrusted peers. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

CVE-2026-94453 · Severity: high · CVSS 7.5 · Published 2026-10-13

Libreswan is an open-source IPsec VPN implementation widely used to secure network communications. A use-after-free vulnerability in its pluto daemon can be triggered when an IKE over TCP connection closes and a subsequent packet arrives, causing the daemon to crash and restart. An unauthenticated attacker on the network can exploit this remotively to cause repeated denial of service, and potential remote code execution is possible.

Technologies: Libreswan. Vendors: Libreswan.

Quick answers

Is CVE-2026-94453 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-94453 being exploited in the wild.
How severe is CVE-2026-94453?: High severity, with a CVSS score of 7.5, published 13 October 2026.
Which products and versions are affected?: Libreswan <5.3.
Is there a fix for CVE-2026-94453?: Yes: fixed in Libreswan 5.3, 5.4. Until then: Disable IKE over TCP if not required by setting listen-tcp=no in the Libreswan configuration, or restrict network access to the pluto daemon from untrusted peers. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-94453 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-94453?: Check whether you run Libreswan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Libreswan 5.3, 5.4

Disable IKE over TCP if not required by setting listen-tcp=no in the Libreswan configuration, or restrict network access to the pluto daemon from untrusted peers.

Technical details

A use-after-free vulnerability exists in pluto's handling of IKE over TCP connections: when a client closes the connection, IKE state is retained with an invalid pointer to iface_endpoint in ike_sa.sa->st_iface_endpoint; a subsequent retransmit or malicious packet for the same tuple dereferences this pointer, crashing the daemon. The vulnerability can be triggered before peer authentication and only affects configurations with listen-tcp=yes enabled.

Affected products

Libreswan Libreswan <5.3

Timeline

2026-10-13: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.